The vulnerability in IBM WebSphere Application Server Liberty allows a remote attacker to bypass security controls due to an incorrect authorization check when the grpc-1.0 feature is enabled. The flaw permits the attacker to access resources or perform actions that should be restricted, potentially exposing confidential data or enabling further compromise of the application server. This represents an authorization bypass weakness, classified as CWE-863.

IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10 are affected, specifically when the grpc-1.0 feature is enabled. The vulnerability applies to deployments of the Liberty runtime variant bundled by IBM across the 20.x to 26.x product lines.

The CVSS score of 7.4 indicates moderate to high severity. The EPSS score of less than 1% signals that exploitation is currently unlikely in the wild, and the flaw is not yet listed in the CISA KEV catalog. Nevertheless, attackers with network visibility to the Liberty instance could attempt to exploit the incorrect authorization logic over the gRPC interface, potentially gaining unauthorized access to protected resources. The risk remains significant until the vulnerability is formally patched.